In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix mr->map double free
rxemrcleanup() which tries to free mr->map again will be called when rxemrinit_user() fails:
CPU: 0 PID: 4917 Comm: rdmaflushserv Kdump: loaded Not tainted 6.1.0-rc1-roce-flush+ #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x45/0x5d panic+0x19e/0x349 endreport.part.0+0x54/0x7c kasanreport.cold+0xa/0xf rxemrcleanup+0x9d/0xf0 [rdma_rxe] _rxecleanup+0x10a/0x1e0 [rdmarxe] rxeregusermr+0xb7/0xd0 [rdmarxe] ibuverbsregmr+0x26a/0x480 [ibuverbs] ibuverbshandlerUVERBSMETHODINVOKEWRITE+0x1a2/0x250 [ibuverbs] ibuverbscmdverbs+0x1397/0x15a0 [ibuverbs]
This issue was firstly exposed since commit b18c7da63fcb ("RDMA/rxe: Fix memory leak in error path code") and then we fixed it in commit 8ff5f5d9d8cf ("RDMA/rxe: Prevent double freeing rxemapset()") but this fix was reverted together at last by commit 1e75550648da (Revert "RDMA/rxe: Create duplicate mapping tables for FMRs")
Simply let rxemrcleanup() always handle freeing the mr->map once it is successfully allocated.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50543.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50543.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_mr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d984dac8f6bf4ebd3398af82b357e1d181ecaac",
"deprecated": false,
"digest": {
"line_hashes": [
"148099719220437707157047081944243371890",
"201743927830139604101537041169830185479",
"158420615329928326959507462842753557662",
"169560661090272643896147461620059215018",
"306840689045341061463898493295779226046",
"300488340240278916658548040519676832067",
"269055734352344370331390492165641084107",
"86859125506002705355224582760177705302",
"52040027332205557594096657474223047841",
"253758743184185154284547163740764061370",
"47787910357866142087701666179121068040",
"104927675032914441723996836120225702679",
"148636735384989107749813330282056489122",
"119278193666812866633379339420189275398",
"231697579576263569480769533448942127874",
"330046895115425554408550718630169789575",
"171330635736091998044254380561622168127",
"290455194819167773145561864929769995002",
"310538336442016788586351000727694240196",
"193377571236615524587249066728281567761"
],
"threshold": 0.9
},
"id": "CVE-2022-50543-1bedb935",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_mr.c",
"function": "rxe_mr_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ce577f09013206e36e674cd27da3707b2278268",
"deprecated": false,
"digest": {
"function_hash": "296519172759069406547289252865053915114",
"length": 794.0
},
"id": "CVE-2022-50543-2b4b5b27",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_mr.c",
"function": "rxe_mr_init_user"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06f73568f553b5be6ba7f6fe274d333ea29fc46d",
"deprecated": false,
"digest": {
"function_hash": "91529044874087147944798338258255980999",
"length": 1535.0
},
"id": "CVE-2022-50543-7124afd3",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_mr.c",
"function": "rxe_mr_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d984dac8f6bf4ebd3398af82b357e1d181ecaac",
"deprecated": false,
"digest": {
"function_hash": "296519172759069406547289252865053915114",
"length": 794.0
},
"id": "CVE-2022-50543-958264c1",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_mr.c",
"function": "rxe_mr_alloc"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06f73568f553b5be6ba7f6fe274d333ea29fc46d",
"deprecated": false,
"digest": {
"function_hash": "296519172759069406547289252865053915114",
"length": 794.0
},
"id": "CVE-2022-50543-aaebf6ca",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_mr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ce577f09013206e36e674cd27da3707b2278268",
"deprecated": false,
"digest": {
"line_hashes": [
"148099719220437707157047081944243371890",
"201743927830139604101537041169830185479",
"158420615329928326959507462842753557662",
"169560661090272643896147461620059215018",
"306840689045341061463898493295779226046",
"300488340240278916658548040519676832067",
"269055734352344370331390492165641084107",
"148662645070881077231811741491578629110",
"314167089735798744915418553371176665254",
"104822542133431419094796085079550562350",
"47787910357866142087701666179121068040",
"104927675032914441723996836120225702679",
"148636735384989107749813330282056489122",
"12153410810910717867260234686330260177",
"117836032983360484848428228271421395742",
"330046895115425554408550718630169789575",
"171330635736091998044254380561622168127",
"290455194819167773145561864929769995002",
"310538336442016788586351000727694240196",
"193377571236615524587249066728281567761"
],
"threshold": 0.9
},
"id": "CVE-2022-50543-bed26a49",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_mr.c",
"function": "rxe_mr_init_user"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d984dac8f6bf4ebd3398af82b357e1d181ecaac",
"deprecated": false,
"digest": {
"function_hash": "71685566645365340970648416504880015878",
"length": 1521.0
},
"id": "CVE-2022-50543-d1ed3555",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_mr.c",
"function": "rxe_mr_init_user"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ce577f09013206e36e674cd27da3707b2278268",
"deprecated": false,
"digest": {
"function_hash": "299653458905228483683846133473777160236",
"length": 1607.0
},
"id": "CVE-2022-50543-e31f34a3",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_mr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06f73568f553b5be6ba7f6fe274d333ea29fc46d",
"deprecated": false,
"digest": {
"line_hashes": [
"148099719220437707157047081944243371890",
"201743927830139604101537041169830185479",
"158420615329928326959507462842753557662",
"169560661090272643896147461620059215018",
"306840689045341061463898493295779226046",
"300488340240278916658548040519676832067",
"269055734352344370331390492165641084107",
"148662645070881077231811741491578629110",
"314167089735798744915418553371176665254",
"104822542133431419094796085079550562350",
"47787910357866142087701666179121068040",
"104927675032914441723996836120225702679",
"148636735384989107749813330282056489122",
"12153410810910717867260234686330260177",
"117836032983360484848428228271421395742",
"330046895115425554408550718630169789575",
"171330635736091998044254380561622168127",
"290455194819167773145561864929769995002",
"310538336442016788586351000727694240196",
"193377571236615524587249066728281567761"
],
"threshold": 0.9
},
"id": "CVE-2022-50543-f252d98b",
"signature_type": "Line"
}
]